Internet security: What will work

Here's a radical plan for making the Internet safe for every legitimate user

In the first column of this year, I discussed computer security outlook and hopes for 2008. I forecast more of the same that we saw in 2007: more spam, more malware, more bad guys basically owning the Internet and our connected computers. I don't see any trends or new leaders with significant power to change the status quo.

That doesn't mean there aren't solutions. Last year, in several columns, I detailed one of the ways that a more secure Internet might be forged in the future. It's my vision. And the more I think about it, it's the only way I can see the Internet becoming significantly more secure. All other plans that I've come across break down under scrutiny or seem to rely on us becoming accustomed to a significant amount of computer crime. The other plans might reduce computer crime, but only temporarily and by a small amount.

I'm far from a computer genius, but I have convinced myself, and a few others, that my plan is right and everyone else's plan is wrong. Boy, I love having my own column.

The perfect plan

Here's my plan in a nutshell: All computer devices, users, and transactions must be authenticated by default.

That's it.

Why do malicious hackers hack? Because we can't catch them. Until we put in place default mechanisms to ensure that most criminals are identified and caught (instead of the current tiny minority now apprehended), hacking will continue unabated.

Instead, we must make all computers, users, and their network communications authenticated and identifiable by default. We start by making hardware impervious to hardware hacks. If someone hacks the hardware, it will refuse to boot. Personally, I don't want to stop hardware mods to iPhones and Xboxes. I just want to stop malicious hackers from modifying participating hardware in such a way that it bypasses all the other mechanisms I propose. Like in the OSI model, if you compromise a lower layer, you can't trust the upper layers.

After verifying a hardware device's boot sequence, the firmware/software portion of the boot process would be verified and accomplished. Each device would have a unique hardware ID that specifically identifies the device and cannot be spoofed.

The user is authenticated using two-factor (or more) or biometric identifiers. Network administrators where the computing device originates, whether on a corporate network, an ISP, or a telco switch, would be held accountable for correctly authenticating the users on their networks.

All OSes and programs would be authenticated and approved before running. If the executable or supporting file isn't approved, it doesn't load into memory. If you allow users to install everything they want without some sort of security approval, then you will never stop bad things or bad people from abusing computers. I'll discuss this more in next week's column.

Because approved users can still do bad things using approved programs, it's essential that network packets be authenticated from source to destination, and traceable back to their originating point. This will prevent a user from creating malware and sending it to another location, or prevent a malicious user from using another innocent user's computer to do the same. In my Internet world, if the bad guy "borrowed" someone else's computer, we'd always be able to trace the perpetrator back to their lair.

Routers and networks that carry our information from point A to point B would also be authenticated and their unique identities added to each passed packet. It wouldn't be as slow as you think -- network devices are working at electric speeds (the speed of light minus minor, unavoidable impedances). Tacking on a unique, authenticable identifier will not add that much overhead.

Join the Good Gear Guide newsletter!

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Roger A. Grimes

InfoWorld

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?